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We present a simple and practical protocol for the solution of a secure multiparty communication 
task, the secret sharing, and its experimental realization. In this protocol, a secret message is split 
among several parties in a way that its reconstruction require the collaboration of the participating 
parties. In the proposed scheme the parties solve the problem by a sequential communication of a 
single qubit. Moreover we show that our scheme is equivalent to the use of a multiparty entangled 
GHZ state but easier to realize and better scalable in practical applications. 
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Splitting a secret message in way that a single per- 
son is not able to reconstruct it is a common task in 
information processing and especially high security ap- 
plications. Suppose e.g. that the launch sequence of a 
nuclear missile is protected by a secret code, and it should 
be ensured that not a single lunatic is able to activate it 
but at least two lunatics. A solution for this problem 
and its generalization including several variations is pro- 
vided by classical cryptography pj and is called secret 
sharing. It consists of a way of splitting the message 
using mathematical algorithms and the distribution of 
the resulting pieces to two or more legitimate users by 
classical communication. However all ways of classical 
communication currently used are susceptible to eaves- 
dropping attacks. As the usage of quantum resources 
can lead to unconditionally secure communication (e.g. 

a protocol introducingquantum cryptography to 
secret sharing was proposed |j, IM la Li ■ I n this protocol 
a shared GHZ-state allows the information splitting and 
the eavesdropper protection simultaneously. But, due 
to lack of efficient multi-photon sources an experimental 
demonstration of secret sharing is still missing. Till now 
solely the principle feasibility of an experimental realiza- 
tion using pseudo-GHZ states was shown 

Here we propose a protocol for (N + 1) parties in 
which only sequential single qubit communication be- 
tween them is used and show its equivalence to the GHZ- 
protocol. As our protocol requires only single qubits it 
is realizable with the current state-of-the-art technolo- 
gies and above all much more scalable with respect to 
the number of participating parties. These gains enabled 
the experimental demonstration of our protocol for six 
parties. To our knowledge this is the first experimental 
implementation of a full protocol for secret sharing and 
by far the highest ever reported number of participants 
in any quantum information processing task. 

Let us first shortly describe the entanglement based 
protocol using a GHZ state for secret sharing. Consider 



(N + 1) persons, each having a particle from the maxi- 
mally entangled (N + 1) particle GHZ-state 

\GHZ) = ^l\00^) + \ll^A)\. (1) 

\ N+l N+l j 

One of the parties, let's call him distributor, wants to dis- 
tribute a secret message among the remaining N persons 
(recipients) in a way that all of them have to cooperate in 
order to reconstruct the distributed message. To achieve 
this task each participant performs a projection mea- 
surement of his particle onto the eigenstates | kj ,<pj) = 
1/V2(|0) + fcjexpO%)|l)) (j = 1,2,..., N + 1) of the 
operator 

°3 (fa ) = ^2 k j\ k j > fa ) < k i >fa\> ( 2 ) 

where kj — ±1 denotes the local result in mode j for a 
preselected parameter <fij. The partners randomly and 
independently choose between <f>j = or tt/2. The corre- 
lation function for a (N+l) particles GHZ state is defined 
as the expectation value of the product of (N +1) local 
results and is therefore given by 

N+l I N+l \ 

E(fa) = ( n = c ° s i e fa j ■ ( 3 ) 

After the measurement each recipient publicly an- 
nounces her/his choice of (f>j, but keeps the result kj 
secret. By doing so the distributor can decide when 
this procedure leads to perfect (anti-)correlated results, 
i.e. when | cos(^ ■ <j)j)\ — 1, which happens in half of 
the runs. In these instances each of the recipients is 
able to infer the distributor's measurement result kd if 
and only if he/she knows the measurement results k r 
(r = 1, 2, . . . , N) of all the other recipients. Consequently 
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FIG. 1: Scheme for (TV + 1) party single qubit secret sharing. 
The distributor prepares a qubit in an initial state and acts 
on it with the phase operator a(cpd). Afterwards the qubit is 
sequentially communicated from one recipient to another each 
acting on it with d(<fij) as well. The last recipient performs 
finally a measurement of the qubit leading to the result ±1. In 
half of the cases the phases add up such that the preparation 
and the measurement are perfectly (anti-)correlated. 



corresponding to <pj S {7r/2, 37r/2}. Following this clas- 
sification they inform the distributor about the class- 
affiliation of their action for each run. Note that they 
keep the particular value of ipj secret. This corresponds 
to the announcement of <pj while keeping k r secret in 
the GHZ-scheme. The order in which the recipients Rj 
announce the class-affiliation is randomly determined by 
the distributor. The last recipient Rjy finally measures 
the received qubit in the x basis. Therefore for her/him 
it suffices to choose only between ip^ = or ip^ = tt/2 
and keep the outcome kjq of the measurement secret [lOj. 
The probability that Rm detects the state | +x) is given 
by 



N 



whereas the probability to detect the state | — x ) is 



(9) 
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the cooperation of all the recipients is required and any 
subset of the parties has no information on the secret. 
For a security proof of this scheme against eavesdropping 
attacks see 0, Q • 

An equivalent (N + 1) party scheme (see fig. |2J for the 
same task where only the sequential communication of a 
single qubit is used, runs as follows. 

The distributor randomly prepares a qubit in one of the 
four states | ±x ) , | ±y ) of two mutually unbiased bases x 
and y with 



|±x) = -^(|0)±|l» 
|±y) = i=(|0)±i|l)). 
Note that all these states are of the form 
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where (pd is chosen to have one out of the four values 
{0, 7T, 7r/2, 37r/2}. During the protocol the qubit is then 
sequentially communicated from recipient to recipient 
each acting on it with the unitary phase operator 




(7) 



where (pj £ {0, tt, tt/2, 37t/2} as well. Therefore having 
passed all parties the qubit will end up in the state 



(8) 



After this communication stage each participant divides 
his action for every run into two classes: a class X cor- 
responding to the choice of ipj £ {0, ir} and a class Y 



P-(<p d ,<pi,...,<p N ) = ^(1 - cos(^ d + ^2<Pj))- (10) 



So the expectation value of the measurement result is 



A(<p d) <p lt . . . , <p N ) = p+(<pd, fi,..., <Pn) 



N 



■P-(<Pd,<PU---,<PN) =C°s(<p d + 22ipj). (11) 



From the broadcasted class-affiliations of all intro- 
duced phase shifts ipj the distributor is able to decide 
which runs lead to perfect (anti-)correlations, means 
when | cos(^d + 52 • tpj)\ — 1, what happens in half of 
the runs. We call this a valid run of the protocol. In 
these cases each of the recipients is able to infer the dis- 
tributor's choice of ipd if and only if he/she knows the 
choice of ifj of the other recipients. Consequently the 
collaboration of all recipients is necessary. 

By associating the particular value of ipd with " 0" and 
"1", say e.g. <p d £ {0,tt/2}=0 and cp d £ {n, 3tt/2} = 1, 
the parties are able to secretly share a common bit string 
(key). This is possible as obviously the required correla- 
tions based on local manipulation of relative phases can 
equivalently be established by communicating a single 
qubit instead of employing many entangled qubits of a 
GHZ- type state; (compare ea uation 131 and [TT|) . 

In order to ensure the security of the protocol against 
eavesdropping or cheating |ll| the distributor arbitrarily 
selects a certain number (might depend on the degree of 
security requirements) of particular valid runs. For this 
subset the correlations are publicly compared, again in a 
random order of the recipients. The public comparison 
will reveal any eavesdropping or cheating strategy. That 
can be easily seen from the following intercept/resend 
eavesdropping attacks. 

Imagine for instance the first recipient R\ tries to 
infer the secret without the help or the authorization 
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of the remaining participants by measuring the qubit 
sent by the distributor before acting on it with ai(ifi) 
and afterwards sending it ahead to the second recipi- 
ent i?2- For convenience, let us assume R\ chooses for 
this measurement one of the two protocol bases x or 
y. As the distributor applies randomly one of four dif- 
ferent phase shifts, the probability that the state \x)i 
is an eigenstate of the measurement chosen by R\ is 
1/2. In the other half of the cases the measurement re- 
sult of Ri will be completely random as it holds that 
\(±y | ±x)\ = \{±x | ±y)\ = 1/2. This means that re- 
cipient Ri gets no information about the distributor's 
choice of ifd- Furthermore this cheating will cause an 
overall error of 25 % in the correlations. That's because 
if Ri has chosen the wrong basis, the final state of the 
qubit after all (N + 1) introduced phase shifts will be of 
the form 




instead of \x)f 

The state \x)fi will, measured by the last recipient 
Rn, give with probability 1/2 a result which is not com- 
patible to the expected correlations. The same situa- 
tion an eavesdropper is faced with, when applying such 
a strategy. The usage of the bases x and y for an inter- 
cept/resend attack is already the optimal one concerning 
the information gain on the valid runs. One might only 
consider using the intermediate (or so called Breidbart) 
basis \±b)-j±—(\±x) + \±y)) = ^(| ) ± e**l*\ 1 )) 

which gives the eavesdropper maximum information on 
all exchanged bits ^3 • But even here the error rate goes 
necessarily up to 25 %. The security of the presented pro- 
tocol against a general eavesdropping attack follows from 
the proven security (see for detail |2J) of the well known 
BB84 protocol 13]. Each communication step between 
two successive parties can be regarded as a BB84 proto- 
col using the bases x and y. Any set of dishonest parties 
in our scheme can be viewed as an eavesdropper in BB84 
protocol. 

The presented protocol was experimentally imple- 
mented for six (5+1) parties, thus clearly showing the 
practicality and user-friendliness of the scheme. 

We encoded the qubit of the protocol in a single pho- 
ton where the basis states 1 ) and 1 1 ) are represented 
by the polarization states of the photon | H ) and | V ) re- 
spectively, corresponding to horizontal (H) and vertical 
(V) linear polarization. The single photons were pro- 
vided by a heralded single photon source. The setup 
is shown in Fig. [3 A pair of photons is created via a 
spontaneous parametric down conversion (SPDC) pro- 
cess. As the photons of a pair are strongly correlated 
in time the detection of one photon in Dt heralds the 
existence of the other one which is used for the proto- 
col. Thus from a coincidence detection between Dt and 
D + /D_ within a chosen time window of 4 ns we assume 
the communication of a single photon only. For this co- 
incidence time window and singlecount rates of about 
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FIG. 2: Setup for single qubit secret sharing. Pairs of orthog- 
onally polarized photons are generated via a type II SPDC 
process in a BBO crystal. The detection of one photon from 
the pair by Dt heralds the existence of the other one used for 
the performance of the protocol. The initial polarization state 
is prepared by the distributor by a polarizer in front of the 
trigger detector and a half- and quarter wave plate (HWPi, 
QWP). Each of the recipients (Ri . . . Rs) introduces one out 
of four phase shifts according to a number from a pseudo 
random number generator (RNG) by the rotation of YVO4 
crystals (Ci . . . C5). The last party analyzes additionally the 
resulting polarization state of the photon with a half-wave 
plate (HWP2) and a polarizing beam splitter. 



70000 s _1 in D + /D_ accidental coincidences were negli- 
gible. The SPDC process was run by pumping a 2 mm 
long /3-barium borate (BBO) crystal with a blue single 
mode laser diode (402.5 nm) at an optical output power 
of 10 mW. Type-II phase matching was used at the de- 
generate case leading to pairs of orthogonally polarized 
photons at a wavelength of A = 805 nm (AA « 6 nm). 

In order to prepare the initial polarization state a po- 
larizer transmitting vertically polarized photons was put 
in front of the trigger detector Dt ensuring that only hor- 
izontally polarized photons can lead to a coincidence de- 
tection. The distributor was equipped with a motorized 
half- wave plate (HWPi) followed by quarter- wave plate 
(QWP) at an angle of 45 °. By rotation of HWPi to the 
angles °, 45 and 22.5 °, -22.5 he could transform the 
horizontally polarized photons coming from the source to 
I ±y ) and | ±x ) . This corresponds to applying the phase- 
shifts (fid G {7r/2,37r/2} and G {0,7r} respectively. As 
the phase-shifts of the recipients had to be applied inde- 
pendently from the incoming polarization state the usage 
of standard wave plates was not possible. Therefore the 
unitary phase operator was implemented using birefrin- 
gent uniaxial 200 /im thick Yttrium Vanadate (YVO4) 
crystals (Ci). The crystals were cut such that their optic 
axis lies parallel to the surface and aligned that H and 
V polarization states correspond to their normal modes. 
Therefore by rotating the crystals along the optic axis 
for a certain angle a specific relative phase shift was ap- 
plied independent from the incoming polarization state. 
An additional YVO4 crystal (C comp , 1000 /im thick) was 
used to compensate for dispersion effects. The last party 
performed the projection measurement using a half-wave 
plate (HWP2) at an angle of 22.5° followed by polariz- 
ing beam-splitter (PBS). The photons were detected at 
D + /D_ and Dt by passively quenched silicon avalanche 
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Ztotai 


Zone 


Zraw 


Zval 


QBER [%] 


\±x) 


27501 


9814 


883 


452 


25.22 ± 2.04 


±y> 


24993 


9188 


784 


409 


30.32 ± 2.27 


|±6> 


38174 


13706 


1137 


588 


30.27 ± 1.89 



TABLE I: Results of the simulation of an intercept /resend 
eavesdropping strategy in the protocol- and intermediate ba- 
sis. The attack was done by inserting a polarizer between the 
distributor and the first recipient. In each case the quantum 
bit error rate (QBER) rises up to more than 25 % and by this 
blows the eavesdropper's cover. 

photo diodes (Si-APD) with an efficiency of about 35 %. 

The protocol was repeated z tota i = 25000 times. One 
run consisted of rotating the crystals and opening the 
detectors for a collection time window r = 200 /is what 
took together about 1 s. Each crystal was thereby driven 
by a motor to one of four different positions given by a 
pseudo random number. This means the application of 
one of the four phase shifts at random by each party. 
Out of Ztotai only z one — 9125 times exactly one photon 
was detected at Dt within r due to poissonian photon- 
counting statistics. In these runs a coincidence detection 
happened z raw — 2107 times which provided us with the 
raw key. From this we extracted z va i — 982 valid runs 
where | cos(J^- ipj)\ = 1 (506 times cos(J2f <pj) = 1 and 
476 times cos(J^ ipj) = — 1 ) with a quantum bit error 
rate (QBER) of 2.34 ± 0.48 %. 

In order to show that the QBER increases signifi- 
cantly by an eavesdropping attack we simulated an in- 
tercept/resend strategy by inserting a polarizer between 
the distributor and the first recipient. The attack was 
done in the protocol bases | ±x ) , | ±y ) as well as in the 
intermediate basis | ±6). For the latter two the polarizer 
was additionally sandwiched by two quarter-wave plates. 
The angular settings (1st QWP, polarizer, 2nd QWP) 
were {45 °, °, -45 °} and {-45 °, 22.5 °, 45 °}. For every 
choice of the basis the QBER went up to at least 25 % 
(or even higher due to other experimental imperfections). 
The results are summarized in Table [I] 

In summary, we introduced a new scheme for solving 
the multi-party communication task of secret sharing. 



Unlike other schemes employing multi-particle entangled 
states our protocol uses only the sequential communica- 
tion of a single qubit. As single qubit operations using 
linear optical elements and the analysis of photon polar- 
ization states are quite well accomplishable with present 
day technology, we were therefore able to present a first 
experimental demonstration of the protocol for six par- 
ties. This is to our knowledge the highest number of 
actively performing parties in a quantum protocol ever 
implemented so far, and the first ever experimental im- 
plementation of a full quantum secret sharing protocol. 
We also simulated an eavesdropping intercept/resend at- 
tack and by this showed the resistance of the protocol 
against such kind of strategies because of a significantly 
increasing error rate. In principle we see no experimen- 
tal barrier to extend the performed protocol to even sig- 
nificantly higher number of participants. The achieved 
key exchange rate could be easily increased by using fast 
electro-optical phase modulators. Also the use of weak 
coherent pulses of light containing much less than one 
photon on average, instead of a heralded single photon 
source, is possible and might further reduce the experi- 
mental effort. However, this would be at the expense of 
the concept of communicating strictly one qubit and can 
be also disadvantageous for the practical performance of 
the protocol [pfl, Il5j. While we have realized our se- 
cret sharing protocol using photons and polarization en- 
coding, alternative schemes, like proposed or realized in 
BB84-type protocols can be adopted as well. One might 
think of other forms of information encoding, higher mul- 
tilevel, or continuous variables. Finally we stress that by 
showing that our approach is equivalent to the use of a 
many qubit GHZ state we opened the door to the pos- 
sible application of this method in other generic multi 
party communication tasks. 
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